sigmamediumHunting

Failed Logon From Public IP

Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

MITRE ATT&CK

T1078 T1190 T1133

privilege-escalationdefense-evasioninitial-accesspersistence

Detection Query

selection:
  EventID: 4625
filter_main_ip_unknown:
  IpAddress|contains: "-"
filter_main_local_ranges:
  IpAddress|cidr:
    - ::1/128
    - 10.0.0.0/8
    - 127.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 169.254.0.0/16
    - fc00::/7
    - fe80::/10
condition: selection and not 1 of filter_main_*

Author

NVISO

Created

2020-05-06

Data Sources

windowssecurity

Platforms

windows

References

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625

Tags

attack.privilege-escalationattack.defense-evasionattack.initial-accessattack.persistenceattack.t1078attack.t1190attack.t1133

Raw Content

title: Failed Logon From Public IP
id: f88e112a-21aa-44bd-9b01-6ee2a2bbbed1
status: test
description: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
author: NVISO
date: 2020-05-06
modified: 2024-03-11
tags:
    - attack.privilege-escalation
    - attack.defense-evasion
    - attack.initial-access
    - attack.persistence
    - attack.t1078
    - attack.t1190
    - attack.t1133
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4625
    filter_main_ip_unknown:
        IpAddress|contains: '-'
    filter_main_local_ranges:
        IpAddress|cidr:
            - '::1/128'  # IPv6 loopback
            - '10.0.0.0/8'
            - '127.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - 'fc00::/7'  # IPv6 private addresses
            - 'fe80::/10'  # IPv6 link-local addresses
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate logon attempts over the internet
    - IPv4-to-IPv6 mapped IPs
level: medium